ml-ECS-rare_user_agent

{
  "job_id": "JOB_ID",
  "indices": [
    "INDEX_PATTERN_NAME"
  ],
  "max_empty_searches": 10,
  "query": {
    "bool": {
      "filter": [
        {"term": {"event.dataset": "dns"}},
        {"term": {"agent.type": "packetbeat"}}
      ],
      "must_not": [
          {"wildcard": {"user_agent.original": {"value": "Mozilla*"}}}
        ]
    }
  }
}